chore(security): bump postcss-selector-parser in datasheetsChat (closes #78)

[benfrank241]

Daily security sweep — datasheetsChat (npm), 2026-09-02.

Alerts closed

alert	advisory	severity	package	fixed by
#78	GHSA-w9m9-85wc-3x92	low	postcss-selector-parser	6.1.2 → 6.1.4

Vulnerable range >= 6.1.0, < 6.1.3. (GitHub reports first_patched_version: null for this advisory, but 6.1.3 and later are outside the declared range; the override resolves to 6.1.4.)

Fix method

postcss-selector-parser is transitive, not a direct dependency, so the fix is an npm overrides entry rather than a manifest bump.

The override is scoped under the two affected parents rather than applied globally:

requester	requested range	resolved before	affected?
postcss-nested	^6.1.1	6.1.2	yes
tailwindcss	^6.0.11	6.1.2	yes
@tailwindcss/typography	6.0.10 (exact pin)	6.0.10	no — below the vulnerable range

A global "postcss-selector-parser": "^6.1.3" override would also have rewritten @tailwindcss/typography's exact 6.0.10 pin, changing a copy that was never vulnerable. Scoping keeps the change limited to what the advisory actually requires.

Lockfile regenerated with npm install --package-lock-only. No --force, no --legacy-peer-deps. The resulting lockfile diff is a single package:

node_modules/postcss-selector-parser: 6.1.2 -> 6.1.4
node_modules/@tailwindcss/typography/node_modules/postcss-selector-parser: 6.0.10 (unchanged)

Verification — differential, per the standing note in #10

npm ci succeeds and the Next.js build compiles successfully. The build then fails in the type-check phase — but this failure is pre-existing on main and unrelated to this change, as documented in issue #10 item 2 (ai@^5 paired with v1-line @ai-sdk/* providers against v4-era call sites in src/app/api/chat/route.ts).

Verified differentially against a clean, unmodified origin/main worktree at the same commit:

check	main (control)	this branch
npm ci	pass	pass
next build — compile	pass	pass
next build — type-check	fail	fail (identical signature)
tsc --noEmit	8 errors	8 errors (byte-identical output)

diff of the two tsc --noEmit outputs is empty — this change introduces no new errors. All 8 are the pre-existing errors catalogued in #10.

npm run lint was not runnable: no ESLint config is committed, so next lint drops into an interactive configuration prompt and never completes non-interactively. Same on main — see #10 item 3.

Not included

• Alert #52 (@ai-sdk/provider-utils, GHSA-866g-f22w-33x8) is deliberately not addressed here and not dismissed — no upstream fix exists (every published version is inside the vulnerable range and every parent pins it exactly). It remains tracked in Daily security sweep — backlog #10 and requires the AI SDK major migration.

Please review and merge at your discretion — this sweep does not merge its own PRs.